topic Re: CSS "flow display <flow identifier>" - timestamp in Application Networking

CSS "flow display " - timestamp

sthon-dbsys — Fri, 19 Mar 2004 09:41:05 GMT

Hi,

does anyone know, how to interprete the timestamp of

"Time last frame was seen = <time>"

in "flow display <flows identifier>.

This value seems to be an absolut timestamp, but I don´t know how could I find out the real time.

In the example the value is "42629":

Time last frame was seen = 42629

What what does this value means.

complete output:

css01-23(debug)# flow active-list

-------- -------------- ----- -------------- ----- -- -------- -------- --------

Flow ID Src IP SPort Dst IP DPort Pr IgrsPort EgrsPort Flow flg

-------- -------------- ----- -------------- ----- -- -------- -------- --------

04010064 172.29.148.171 389 172.29.27.133 52440 6 01203240 00201940 822a2a00

04010923 172.29.148.171 389 172.29.27.133 56537 6 01203240 00201940 822a2a00

css01-23(debug)# show clock

Date: 03-19-2004

Time: 10:20:17

TimeZone: mez: +01:+00:+00

css01-23(debug)#

css01-23(debug)# flow display 0x04010064

Flow found on SP on Slot 2, Subslot 1

Detailed information for FlowId: 0x04010064, FpId: 0x844A5A40:

Ingress port = 0x01203240 Egress port = 0x00201940

State of this flow ( flow flags ) = 0x822a2a00 0x00

Partner flow id = 0x400ff8e

FCB flags = 0x00000419

Route Id = 0x8a63ac90

Host Id = 0x8a6d1480

Total number of SYNs received for this flow = 0

WCC cookie stat for this flow = 0

Protocol is TCP

IP: Source = 172.29.148.171-389 Dest = 172.29.27.133-52440

NAT IP: Source = 172.29.149.147-389 Dest = 172.29.27.133-52440

NAT tcp seq num delta used in L5 spoofing = 0x00000000

Time last frame was seen = 42629

Flow statistics bytesIn = 0 framesIn = 0

Src macaddr = 00-0b-fd-be-c6-7d Dest macaddr = 00-01-f4-16-e5-e6

Out of sequence discards = 0

Session Redundancy State: Active

Previous Flow ID: 0x0

Local Flow ID: 0x4010064

css01-23(debug)# show clock

Date: 03-19-2004

Time: 10:24:54

TimeZone: mez: +01:+00:+00

css01-23(debug)# flow display 0x04010064

Flow found on SP on Slot 2, Subslot 1

Detailed information for FlowId: 0x04010064, FpId: 0x844A5A40:

Ingress port = 0x01203240 Egress port = 0x00201940

State of this flow ( flow flags ) = 0x822a2a00 0x00

Partner flow id = 0x400ff8e

FCB flags = 0x00000419

Route Id = 0x8a63ac90

Host Id = 0x8a6d1480

Total number of SYNs received for this flow = 0

WCC cookie stat for this flow = 0

Protocol is TCP

IP: Source = 172.29.148.171-389 Dest = 172.29.27.133-52440

NAT IP: Source = 172.29.149.147-389 Dest = 172.29.27.133-52440

NAT tcp seq num delta used in L5 spoofing = 0x00000000

Time last frame was seen = 42629

Flow statistics bytesIn = 0 framesIn = 0

Src macaddr = 00-0b-fd-be-c6-7d Dest macaddr = 00-01-f4-16-e5-e6

Out of sequence discards = 0

Session Redundancy State: Active

Previous Flow ID: 0x0

Local Flow ID: 0x4010064

regards

sascha

Re: CSS "flow display " - timestamp

Gilles Dufour — Fri, 19 Mar 2004 12:46:41 GMT

Sascha is this a 1st gen or 2nd gen CSS ?

If 2nd gen, you should actually use a different command.

'flow-agent show active_fcbs'

then

'flow-agent show fcb_details 0x'

With the 2nf gen, you can poll the flow-agent that is responsible to do the fastswitching.

It will give you better info then the old command which gives only information seen at software level.

Regards,

Gilles.

Re: CSS "flow display " - timestamp

sthon-dbsys — Mon, 22 Mar 2004 12:58:25 GMT

Hi Gilles,

thanks for feedback, the cmd works:

css01-23(debug)# flow-agent show active_fcbs

-------- -------------- ----- -------------- ----- -- -------- ------- --------

Flow ID Src IP SPort Dst IP DPort Pr slot sub spt dpt Flow flg

-------- -------------- ----- -------------- ----- -- -------- ------- --------

83d4cb60 172.29.148.168 81 172.19.28.165 2015 6 2 1 1 1 00000099

83e31160 172.29.148.168 81 172.26.54.87 1963 6 2 1 1 1 00000099

83a2f3a0 172.29.148.171 389 172.29.148.170 16034 6 2 1 1 1 00000119

--Cancelled---

css01-23(debug)# flow-agent show fcb_details 0x8394a140

css01-23(debug)#

Fcb Details for FCB: 0x8394A140

SRC: 172.29.148.171-389 NAT: 172.29.149.146-389

DST: 172.29.148.170-15970 NAT: 172.29.97.219-14786

DMAC: 00-01-f4-16-e5-e6 SMAC: 00-0b-fd-be-c6-7d

IP Hdr ChkD: 12776 TCP/UDP Hdr ChkD: 13960

TCP SequenceD: 0 Task CE: 0

BytesIn: 246 Frames In: 4

Dest VLAN: 101 Src/Dst Ports: 0/0

Slot/SubSlot: 2/1 SmbQ/PrcSwP: 32/1

Time Stamp / Time Out Info:

CurSecs: 314997:428, started: 150399:756 last activity: 150399

May timeout due to inactivity: No , inactiveTimeout: 0

FCB Flags: 0x0119

0x0001 - Natting In Use

0x0000 - NOT L5 Aware

0x0000 - Non-Spoofed

0x0008 - IP/TCP Flow

0x0010 - Remote - Egress port

0x0100 - In LL List

0x0000 - Server-side

FCB FlaFlags: 0x8040

0x0040 - Is a static FCB

0x8000 - Handled an ACK

how could I interprete the following line of the Time Stamps ?

Time Stamp / Time Out Info:

CurSecs: 315164:145, started: 150399:756 last activity: 150399

my goal is to find a parameter to see how long the session is inactive !

regards

sascha

Re: CSS "flow display " - timestamp

Gilles Dufour — Mon, 22 Mar 2004 14:37:44 GMT

ok.

From the code.

CurSecs: 315164:145 means 315164sec and 145 msec.

Last activity means the time when a packet was seen last time in sec.

The time is a value in seconds since boot.

So you should do CurSecs - last activity to have the

idle time.

Gilles.

Re: CSS "flow display " - timestamp

sthon-dbsys — Tue, 23 Mar 2004 09:13:51 GMT

that looks fine.

thanks

sascha